Securing ASP Data Access

We want to create three data types, which I have chosen to call ODBCDataSource, ODBCUserName, and ODBCPassword. The data stored in these values will be used to replace the text strings in that awful ADODB command at the beginning of this article. If you want to use DSN-less connections, you can extend this list further to include a server and database name as well. You can do the same kind of thing to add other types of connection information for WinNT, Active Directory, LDAP, or whatever you like.

What you don't want to do its take forever to get this part done. After all, we're not even at the useful bits yet. So, I've included a VBScript file called MetaSchema.vbs that you can use to extend the metabase schema, so that it includes these data types. Simply put the script on the desired server, open your command prompt, navigate to it, and then type its name to execute it. You'll need to run it using an account with Administrator level access.

• MetaSchema.vbs

Our sample script does four things. First it creates a class for the new data types. I chose to name this class DataAccessMethods. Next, it creates the three data types we described, then adds the data types to the class. Finally, it creates a class for the container that will hold each of our DataAccessMethods instances, called DataAccessStorage.

In this example, all the data types are strings with default settings for inheritance and security. Also, be aware that the error detection is very rudimentary. If the script detects an error, it will simply stop working. In many cases it will skip the remaining code without even reporting the error. As an advanced exercise you can add these features later. However, for the purpose of illustrating our point, this script will run fine as it is.

Now, here's a little more detail about what is going on in this script. If you've done programming using ADSI before, this code will seem very basic to you. You may have been exposed to this through Windows 2000 or Microsoft Site Server. Regardless of whether you are familiar with ADSI or not, this code should be reasonably self-explanatory, and you should be able to familiarize yourself with the syntax by comparing the path names you see in the code to the paths visible when using MetaEdit.

The first thing it does after defining some constants is bind to the IIS metabase schema.

This is done by using the machine name, in this case "localhost", to create the metabase path. This path is then passed to the GetObject function, which is part of the ADSI component model. The remainder of the script uses the schema object to perform various functions.